running tailscaled agent in proxy mode requires significantly less "installation" than installing the full tailscale "VPN" experience.

sure, it could be streamlined even more (currently it requires that you run "tailscaled -tun userspace-networking", possibly with a custom unix domain socket path, and then also run "tailscale up" to activate it)